package com.Modules.NormalData;
import cn.hutool.core.date.DateTime;
import com.common.entity.XdrHoneypot;
import com.common.mapper.XdrHoneypotMapper;
import com.common.service.SyslogNonNormalMessageService;
import com.common.util.*;
import com.config.AppConfig;
import org.apache.ibatis.session.SqlSession;
import org.springframework.beans.factory.annotation.Autowired;
import com.common.entity.SyslogMessage;
import com.influx.SyslogToInfluxApp;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.common.service.DmNormalizeRuleService;
import com.common.service.DmColumnService;
import com.common.service.SyslogNormalDataService;
import com.common.entity.DmColumn;
import com.common.service.impl.DmColumnServiceImpl;
import com.common.mapper.DmColumnMapper;
import org.springframework.stereotype.Service;
import org.springframework.web.bind.annotation.RestController;
import com.common.mapper.DmColumnMapper;
import com.common.mapper.DmNormalizeRuleMapper;
import java.sql.Timestamp;
import java.util.*;

import org.springframework.stereotype.Component;
import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;

import org.json.JSONObject;
import com.common.entity.RuleContent.*;
import com.common.entity.SyslogNonNormalMessage;
import org.joda.time.LocalDateTime;
import com.common.service.LogDataFilterService;
import com.common.service.LogDataCompleteService;
import com.common.service.DeviceCollectTaskService;
import com.common.entity.DeviceCollectTask;
import com.common.entity.DeviceDevice;
import com.common.util.TimeConversionUtils;
import com.common.service.DeviceDeviceService;

public class LogNormalProcessor {
    private static final Logger logger = LoggerFactory.getLogger(LogNormalProcessor.class);

    private String  strLogMsg  ;
    private String  strKafkaMessage;
    private String strDeviceInfo;
    private String strDataType ="json" ;
    private Map<String, Object> messageMap ;
    private Map<String, String> deviceInfoMap ;
    private String  strSyslogUUID  ;
    private String  strSyslogTopic  ;
    private boolean isSaveNonNormal =false ;

    @Autowired
    public DmNormalizeRuleService dmNormalizeRuleService ;
    @Autowired
    public DmColumnService dmColumnService  ;
    @Autowired
    public SyslogNormalDataService syslogNormalDataService =SpringContextUtil.getBean(SyslogNormalDataService.class);
    @Autowired
    private SyslogNonNormalMessageService messageService =SpringContextUtil.getBean(SyslogNonNormalMessageService.class);
    @Autowired
    private  LogDataFilterService logDataFilterService=  SpringContextUtil.getBean(LogDataFilterService.class);

    @Autowired
    private  LogDataCompleteService  logDataCompleteService=  SpringContextUtil.getBean(LogDataCompleteService.class);
    @Autowired
    private  DeviceCollectTaskService  deviceCollectTaskService=  SpringContextUtil.getBean(DeviceCollectTaskService.class);
    @Autowired
    private  DeviceDeviceService  deviceDeviceService=  SpringContextUtil.getBean(DeviceDeviceService.class);

    @Autowired
    SyslogNonNormalMessage syslogNonNormalMessage=new SyslogNonNormalMessage();

    @Autowired
    DmColumnMapper  dmColumnMapper;
    @Autowired
    DmNormalizeRuleMapper dmNormalizeRuleMapper;

    private   List<Map<String, Object>> dmNormalizeRuleList;
    private   List<Map<String, Object>> dmColumnList;
    private   LinkedHashMap<String, Object>   OrginalColumnMap ;

    public  LogNormalProcessor( String LogMsg, String syslogUUID,String syslogTopic) {

        /** 标准化数据处理步骤 */
        //初始化 （获取syslog_normal_data 表全部字段的属性、设备ID对应的规则设置、转化成JSON）
        //判断数据解析类型（json、键值、xml、正则表达式、分割符）解析syslogMessage 字段转成 HashMAP
        //匹配规则内容，获取字段映射关系配置，抽取命中的字段名称、数值
        //判断字段内容及类型，根据数据类型属性，进行内容转换。
        //生成insert SQL语句、执行入库操作。
        strKafkaMessage=LogMsg;
        strSyslogUUID=syslogUUID;
        strSyslogTopic=syslogTopic;

        if(!LogMsg.isEmpty()) {
            strLogMsg = SyslogParser.substringAfterFirstCloseBracket(LogMsg);
            strDeviceInfo=SyslogParser.substringBeforeFirstChar(LogMsg,']');
        }
        else{
            LogMsg="[receive_time=20251118165909470 device_id=1 device_name=honeypot vendor=changting data_type=json device_collect_id=1]<14>1 2025-09-24T11:52:26Z 5f46d3be75e1 supermario 128 honeypot_event - ﻿{\"source\":\"honeypot1\",\"id\":\"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a\",\"start_time\":\"2023-09-03T11:07:02.50167643Z\",\"time\":\"2023-09-03T11:16:18.883885281Z\",\"risk_level\":4,\"connection\":\"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf\",\"file_info\":null,\"extra\":{\"payload\":{\"format\":\"line\",\"name\":{\"cn\":\"攻击载荷\",\"en\":\"payload\"},\"value\":\"\"},\"uid\":{\"format\":\"line\",\"name\":{\"cn\":\"\",\"en\":\"\"},\"uid\":\"b4cbc73c-25d0-4429-ae1b-a856cdf1a651\",\"value\":\"\"}},\"type\":\"WEB_ATTACK_SCANNER\",\"agent_sn\":\"caa7da42-0cca-4cb1-b501-1f1eb2b588d5\",\"agent_name\":\" 教育局蜜罐探针\",\"honeypot_id\":\"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6\",\"honeypot_name\":\"茂名市中小学管理平台管理后台\",\"src_ip\":\"117.50.189.7\",\"src_port\":58512,\"src_mac\":\"\",\"dest_ip\":\"192.168.222.2\",\"dest_port\":9200,\"proxy_ip\":null,\"node\":\"WRx3\"}";
            strLogMsg="<14>1 2025-09-24T11:52:26Z 5f46d3be75e1 supermario 128 honeypot_event - ﻿{\"source\":\"honeypot1\",\"id\":\"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a\",\"start_time\":\"2023-09-03T11:07:02.50167643Z\",\"time\":\"2023-09-03T11:16:18.883885281Z\",\"risk_level\":4,\"connection\":\"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf\",\"file_info\":null,\"extra\":{\"payload\":{\"format\":\"line\",\"name\":{\"cn\":\"攻击载荷\",\"en\":\"payload\"},\"value\":\"\"},\"uid\":{\"format\":\"line\",\"name\":{\"cn\":\"\",\"en\":\"\"},\"uid\":\"b4cbc73c-25d0-4429-ae1b-a856cdf1a651\",\"value\":\"\"}},\"type\":\"WEB_ATTACK_SCANNER\",\"agent_sn\":\"caa7da42-0cca-4cb1-b501-1f1eb2b588d5\",\"agent_name\":\" 教育局蜜罐探针\",\"honeypot_id\":\"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6\",\"honeypot_name\":\"茂名市中小学管理平台管理后台\",\"src_ip\":\"117.50.189.7\",\"src_port\":58512,\"src_mac\":\"\",\"dest_ip\":\"192.168.222.2\",\"dest_port\":9200,\"proxy_ip\":null,\"node\":\"WRx3\"}";
            strDeviceInfo=SyslogParser.substringBeforeFirstChar(LogMsg,']');
        }
    }
    /**
     * 初始化数据init()
     */
    public void init()
    {
        Map<String,String> mapdev  =SyslogParser.parseKeyValuePairs(strDeviceInfo);
        deviceInfoMap=mapdev;
        //获取日志对应的设备ID
        long deviceID=Long.parseLong(mapdev.get("device_id"));
        System.out.println("device_id:"+deviceID );
        strDataType=mapdev.get("data_type");
        //getDeviceID(strLogMsg);
        try{
            // 通过工具类获取Service实例
            dmColumnService= SpringContextUtil.getBean(DmColumnService.class);
            dmNormalizeRuleService= SpringContextUtil.getBean(DmNormalizeRuleService.class);
            if(deviceID>0) {
                dmNormalizeRuleList = dmNormalizeRuleService.selectByDeviceIdAuto(deviceID);
            }
            //dmColumnList=dmColumnService.selectAllNormal();
            //System.out.println("dmColumnList size:"+ dmColumnList.size());

            //OrginalColumnMap=getMessageToMap(strLogMsg);
            //解析SyslogMessage
            //SyslogMessage logMsg = SyslogParser.parse(strLogMsg);
            //设备对应的规则normal rule Map 进行标准化数据处理
            for (int i = 0; i < dmNormalizeRuleList.size(); i++) {
                try {
                    Map<String, Object> dmNormalizeRule = dmNormalizeRuleList.get(i);
                    String data_type = dmNormalizeRule.get("data_type").toString();
                    //数据类型及格式不符，则break;
                    System.out.println("索引: " + i + ", 值: " + dmNormalizeRule);
                    System.out.println("normalrule  ID: " + dmNormalizeRule.get("id") + ", display_name:" + dmNormalizeRule.get("display_name") + " data_type:" + dmNormalizeRule.get("data_type"));
                    //数据类型不匹配，则跳过规则
                    //if (!data_type.equals(strDataType))  break;

                    //获取syslog message 文本解析配置项
                    OrginalColumnMap = getMessageToMap(dmNormalizeRule, strLogMsg, data_type);
                    if ((OrginalColumnMap == null) || (OrginalColumnMap.size()==0)) {
                        logger.error("OrginalColumnMap 对象获取为空");
                        //保存非标日志信息
                        syslogNonNormalMessage.setReason("Log解析异常");
                        syslogNonNormalMessage.setReasonDetail("log解析异常,返回规则名称："+dmNormalizeRule.get("display_name") +",OrginalColumnMap 对象获取为空");
                        if(isSaveNonNormal==false)
                        SaveNonNormalMessage(deviceID, DateTime.now());
                        continue;
                    }
                    List<HashMap<String, Object>> destColumnList = getRuleContentMappers(dmNormalizeRule);
                    //解析字段匹配已命中的配置规则字段
                    List<HashMap<String, Object>> ruleColumnList = getNormalColumnList(OrginalColumnMap, destColumnList);
                    //System.out.println("ruleColumnList  :"+ ruleColumnList);
                    Map<String, Object> destMap = getColumnMap(ruleColumnList);
                    //List<HashMap<String ,Object>>   destMap2= getCompleteColumnsList(dmNormalizeRule);

                    //数据处理-过滤规则
                    if (logDataFilterService.evaluateFilterRule(dmNormalizeRule.get("rule_content").toString(), destMap))
                        continue;

                    //数据处理-补全规则
                    logDataCompleteService.processDataCompletion(dmNormalizeRule.get("rule_content").toString(), destMap);
                    //long ruleid=Long.parseLong(dmNormalizeRule.get("id").toString());
                    SaveNormalData(deviceID, DateTime.now(), destMap, Long.parseLong(dmNormalizeRule.get("id").toString()), dmNormalizeRule.get("name").toString());

                } catch (Exception ex) {
                    logger.error("泛化规则处理失败：" + ex.getMessage());
                    System.out.println(ex.getMessage());
                    /**
                    //保存非标日志信息
                    syslogNonNormalMessage.setReason("泛化规则处理失败");
                    syslogNonNormalMessage.setReasonDetail("泛化规则处理失败,失败详情："+ ex.getMessage());
                    SaveNonNormalMessage(deviceID,DateTime.now());
                     **/

                }
            }
        }
        catch (Exception ex)
        {
            logger.error("处理初始化异常："+ex.getMessage());
            System.out.println(ex.getMessage());
        }

    }


    //获取数据泛化规则的列表字段，提取 Cropper_params
    public  Cropper_paramsType  getCropperParams(  Map<String, Object> dmNormalizeRule )
    {
        Cropper_paramsType  cropperParams = new Cropper_paramsType();
        try {
            JSONObject jsonObject = new JSONObject( dmNormalizeRule.get("rule_content").toString());
            if (jsonObject.isEmpty()) return null;

            cropperParams.sethead_key(jsonObject.getJSONObject("cropper_params").get("head_key").toString());
            //需要判断是否字符串head_offset是否空
            cropperParams.sethead_offset(Integer.parseInt(jsonObject.getJSONObject("cropper_params").get("head_offset").toString()));
            cropperParams.settail_key(jsonObject.getJSONObject("cropper_params").get("tail_key").toString());
            //需要判断是否字符串tail_offset是否空
            cropperParams.settail_offset( Integer.parseInt(jsonObject.getJSONObject("cropper_params").get("tail_offset").toString()));
            return cropperParams;
    }catch (Exception ex) {
            logger.error("getCropperParams："+ex.getMessage());
            return null;
        }

    }


    public  List<HashMap<String ,Object>>  getRuleContentMappers(  Map<String, Object> dmNormalizeRule )
    {
        List<HashMap<String, Object>>   filedList =null;
        ObjectMapper objectMapper = new ObjectMapper();
        try {
            // 转换为list Map
            //Map<String, Object> rule_contentMap = objectMapper.readValue( dmNormalizeRule.get("rule_content").toString(),  Map.class);
            //if (rule_contentMap.isEmpty()) return null;
            JSONObject jsonObject = new JSONObject( dmNormalizeRule.get("rule_content").toString());
            if (jsonObject.isEmpty()) return null;
            ObjectMapper objectMapper_mappers = new ObjectMapper();
            filedList =readJsonToList( jsonObject.get("mappers").toString() );

        }catch (Exception ex) {
            logger.error("getRuleContentMappers异常："+ex.getMessage());
        }
        return filedList;
    }



    public  List<HashMap<String, Object>>  getCompleteColumnsList(  Map<String, Object> dmNormalizeRule )
    {
        List<HashMap<String, Object>>   filedList =null;
        ObjectMapper objectMapper = new ObjectMapper();
        try {
            // 转换为list Map
            //Map<String, Object> rule_contentMap = objectMapper.readValue( dmNormalizeRule.get("rule_content").toString(),  Map.class);
            //if (rule_contentMap.isEmpty()) return null;
            JSONObject jsonObject = new JSONObject( dmNormalizeRule.get("rule_content").toString());
            if (jsonObject.isEmpty()) return null;
            ObjectMapper objectMapper_mappers = new ObjectMapper();
            filedList =readJsonToList( jsonObject.get("complete_columns").toString() );

        }catch (Exception ex) {
            logger.error("getCompleteColumnsList："+ex.getMessage());
        }
        return filedList;
    }
    /**
     * 将JSON 字符串转换为 List<HashMap<String, Object>>
     */
    public static List<HashMap<String, Object>> readJsonToList(String jsonStr) {
        ObjectMapper objectMapper = new ObjectMapper();
        try {
            return objectMapper.readValue(
                    jsonStr,
                    new TypeReference<List<HashMap<String, Object>>>() {}
            );
        } catch (Exception e) {

            logger.error("readJsonToList 解析失败："+jsonStr);
            //throw new RuntimeException("JSON 解析失败: " + e.getMessage(), e);
            return null;
        }
    }
    /**\
     * 判断日志信息的数据类型
     * @param logMsg
     * @return
     */
    public    String  getLogDataType( String logMsg)
    {
        //判断日志信息的数据类型(json、regex、kv、sep、xml）
        //默认返回json
        return "json";
    }

    public    int  getDeviceID( String logMsg)
    {
        //解析日志信息头部，获取device_id
        // 默认返回device_id =1
        return 1;
    }
    //获取log 内容字段及数据值
    public    LinkedHashMap<String, Object>  getMessageToMap( String MsgContent )
    {
        LinkedHashMap<String, Object> linkMap =null;
        if(strDataType.equals("json")) {
            //json 类型
            //解析SyslogMessage
            SyslogMessage msg = SyslogParser.parse(MsgContent);
            System.out.println("解析结果-log content: " + msg.getMessage().toString());
            String complexJson = "{\"source\":\"honeypot1\",\"id\":\"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a\",\"start_time\":\"2023-09-03T11:07:02.50167643Z\",\"time\":\"2023-09-03T11:16:18.883885281Z\",\"risk_level\":4,\"connection\":\"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf\",\"file_info\":null,\"extra\":{\"payload\":{\"format\":\"line\",\"name\":{\"cn\":\"攻击载荷\",\"en\":\"payload\"},\"value\":\"\"},\"uid\":{\"format\":\"line\",\"name\":{\"cn\":\"\",\"en\":\"\"},\"uid\":\"b4cbc73c-25d0-4429-ae1b-a856cdf1a651\",\"value\":\"\"}},\"type\":\"WEB_ATTACK_SCANNER\",\"agent_sn\":\"caa7da42-0cca-4cb1-b501-1f1eb2b588d5\",\"agent_name\":\" 教育局蜜罐探针\",\"honeypot_id\":\"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6\",\"honeypot_name\":\"茂名市中小学管理平台管理后台\",\"src_ip\":\"117.50.189.7\",\"src_port\":58512,\"src_mac\":\"\",\"dest_ip\":\"192.168.222.2\",\"dest_port\":9200,\"proxy_ip\":null,\"node\":\"WRx3\"}";
            System.out.println("complexJson content: " + complexJson);
            //静态字符串、编码有问题，临时用 静态字符串做测试，流程环境没问题
            if(AppConfig.geRunEnvironment‌().equals("dev")) {
                //LinkedHashMap<String, Object> flatMap = JsonParser.parseJsonToFlatMap(complexJson);
                LinkedHashMap<String, Object> flatMap =JsonParser.jsonToMap(complexJson);
                flatMap.forEach((key, value) -> System.out.println(key + " = " + value));
                return flatMap;
            }
            else
            {
                //LinkedHashMap<String, Object> flatMap = JsonParser.parseJsonToFlatMap(msg.getMessage());
                LinkedHashMap<String, Object> flatMap =JsonParser.jsonToMap(msg.getMessage());
                flatMap.forEach((key, value) -> System.out.println(key + " = " + value));
                return flatMap;
            }
        }
        else if(strDataType.equals("kv")) //key-value 键值类型
        {
            return null;
        }
        else if(strDataType.equals("sep")) //分隔符
        {
            return null;
        }
        else if(strDataType.equals("xml")) //类型 xml
        {
            return null;
        }
        else if(strDataType.equals("regex")) //正则表达式
        {
            return null;
        }
        // List<Map<String, Object>> rulelst=dmNormalizeRuleService.selectByDeviceId((long)1);
        return linkMap;
    }


    //获取log message内容字段及数据值
    public    LinkedHashMap<String, Object>  getMessageToMap( Map<String, Object> dmNormalizeRule,  String MsgContent ,  String dataType)
    {
        LinkedHashMap<String, Object> linkMap = new LinkedHashMap<>();
        try {
            //String decode =dmNormalizeRule.get("decode").toString();
            Cropper_paramsType  cropperParams = getCropperParams(dmNormalizeRule);
            if (dataType.equals("json")) {
                String strJson = logNormalData.ParserMessageJsonType(MsgContent, cropperParams);
                LinkedHashMap<String, Object> result1 = NestedJsonParserUtil.safeParseJson(strJson);
                LinkedHashMap<String, Object> flattened = NestedJsonUtils.flattenNestedJson(result1);
                return flattened;
                //parseJsonToFlatMap 复杂的json转换、解析过程有异常
                //return JsonParser.parseJsonToFlatMap(strJson);
               // return JsonParser.jsonToMap(strJson);
            }
            else if (dataType.equals("kv")) //key-value 键值类型
            {
                String strKeyVal = logNormalData.ParserMessageJsonType(MsgContent, cropperParams);
                KvTextParser kvTextParser =new KvTextParser();
                kv_paramsType kvparams=logNormalData.getkv_paramsType( dmNormalizeRule);
                linkMap=  kvTextParser.parseKvText(strKeyVal,kvparams);
                return linkMap;
            }
            else if (dataType.equals("sep")) //分隔符
            {
                //获取分隔符
                String SepKey=logNormalData.sepType(dmNormalizeRule);
                String strSep = logNormalData.ParserMessageJsonType(MsgContent, cropperParams);
                linkMap= TextParserUtil.parseSeparatedText(strSep, SepKey);
                return linkMap;
            }
            else if (dataType.equals("xml")) //类型 xml
            {
                return linkMap;
            }
            else if (dataType.equals("regex")) //正则表达式
            {
                String strRegex = logNormalData.ParserMessageJsonType(MsgContent, cropperParams);
                String regexp= logNormalData.Regexp(dmNormalizeRule);
                linkMap= RegexTextParser.parseWithRegex(strRegex,regexp );
                return linkMap;
            }
        }catch (Exception ex) {
            logger.error("getMessageToMap："+ex.getMessage());
            return  null;
        }
        return linkMap;
    }

    /**
     * 根据设备ID获取配置规则
     * @param device_id
     * @return List<Map<String, Object>>
     */
    public     List<Map<String, Object>> getRuleList( long  device_id)
    {
        List<Map<String, Object>> rulelst=dmNormalizeRuleService.selectByDeviceId((long)1);
        if (rulelst!=null)
        {
            System.out.println("rulelst: " + rulelst);
        }
        else{
            logger.error(" List<Map<String, Object>> rulelst is null！" );
        }
        return rulelst;
    }

    /**
     *  查找命中配置规则的字段及数值
     * @param destColumnList   泛化目标字段list
     * @param destColumnList  日志源字段及数值list
     * @return
     */
    public List<HashMap<String,Object>>  getNormalColumnList(  LinkedHashMap<String, Object> orginColumnMap ,List<HashMap<String, Object>> destColumnList   )
    {
        List<HashMap<String, Object>>  columnlist =new ArrayList<>();
        // 原始解析字段遍历泛化规则目标字段
        for (Map.Entry<String, Object > entry : orginColumnMap.entrySet()) {
            //System.out.println(entry.getKey() + ": " + entry.getValue());
            for (Map<String, Object> map : destColumnList) {
                //System.out.println( "origin_field: " +  map.get("origin_field").toString());
                if ( map.get("origin_field").toString().equals(entry.getKey()) ) {
                    System.out.println(map);
                    Map<String, Object> normalColumMap =new LinkedHashMap<>();
                    normalColumMap.put("origin_field",entry.getKey() );
                    normalColumMap.put("dest_field",map.get("dest_field").toString());
                    normalColumMap.put("action",(HashMap<String, Object>)map.get("action") );
                    //normalColumMap.put("mapping ",entry.getKey() );
                    normalColumMap.put("origin_field_value",entry.getValue() );
                   // System.out.println("action: " +  map.get("action").toString());
                    if(  ((HashMap<String, Object>)map.get("action")).get("type").equals("equal"))
                        //直接赋值
                        normalColumMap.put("dest_field_value",entry.getValue() );
                    else if(((HashMap<String, Object>)map.get("action")).get("type").equals("mapping"))
                    {
                        //mapping 映射枚举值
                        normalColumMap.put("dest_field_value",entry.getValue() );
                        normalColumMap.put("action_param",((HashMap<String, Object>)map.get("action")).get("param") );
                        HashMap<String, Object> action_param=(HashMap<String, Object>)((HashMap<String, Object>)map.get("action")).get("param") ;
                        //匹配并获取映射枚举值
                        normalColumMap.put("dest_field_value",getMappingValue(action_param ,entry.getValue().toString() ));
                    }
                    else if(((HashMap<String, Object>)map.get("action")).get("type").equals("time"))
                    {
                        //time 类型
                        //normalColumMap.put("dest_field_value",entry.getValue() );
                        normalColumMap.put("action_param",((HashMap<String, Object>)map.get("action")).get("param") );
                        HashMap<String, Object> action_param=(HashMap<String, Object>)((HashMap<String, Object>)map.get("action")).get("param") ;
                        //匹配时间格式并转成换整型格式
                        try {
                            long longTime = TimeConversionUtils.convertToMillis(entry.getValue().toString(), action_param.get("timezone").toString());
                            normalColumMap.put("dest_field_value", longTime);
                        } catch (Exception e) {
                            logger.error("时间类型转换错误，源值：" + entry.getValue().toString() + ",java_date_format:" + action_param.get("java_date_format").toString());
                            e.printStackTrace();
                        }

                    }
                    columnlist.add((HashMap<String, Object>)normalColumMap);
                    //System.out.println( "normalColumMap: " +normalColumMap);
                    //存在源字段配置多个目标字段，使用continue,而不是break
                    continue;
                }
            }
        }
        return columnlist;
    }

    /**
     * paramMapping Map匹配查找对应的值
     * @param paramMappingValueMap
     * @param
     * @return
     */
    public Object getMappingValue(HashMap<String, Object> paramMappingValueMap,String value)
    {
        HashMap<String, Object> Map= (HashMap<String, Object>)paramMappingValueMap.get("mapping");
        for (Map.Entry<String, Object > entry : Map.entrySet()) {
            if ( entry.getKey().equals(value) ) {
                return  entry.getValue();
            }
        }
        return null;
    }

    /**
     * 获取字段Map，包含字段field及Value值
     * @param normalColumnList
     * @return
     */
    public Map<String, Object > getColumnMap( List<HashMap<String,Object>>  normalColumnList )
    {
        Map<String, Object > columnMap= new HashMap<>();
        for (Map<String, Object> map : normalColumnList) {

            Object destFieldValue = map.get("dest_field_value");
            // 判断 dest_field_value 是否为 String 且包含 "\u0000"
            if (destFieldValue instanceof String && ((String) destFieldValue).contains("\u0000")) {
                // 替换掉所有 "\u0000" 字符
                destFieldValue = ((String) destFieldValue).replace("\u0000", "");
            }
            columnMap.put(map.get("dest_field").toString(), destFieldValue);
            //columnMap.put(map.get("dest_field").toString(),map.get("dest_field_value"));
        }
        return columnMap;
    }

    /**
     * 保存数据到标准化表
     * @param deviceId
     * @param logtime
     * @param logColumnMap
     */
    public void SaveNormalData(long deviceId , DateTime  logtime,  Map<String, Object > logColumnMap, long normalizeRuleId ,String normalizeRuleName)
    {
        try {
            if(logColumnMap.isEmpty() )
            {
                logger.error("SaveNormalData ->logColumnMap 为空，syslogUUID:" +this.strSyslogUUID);
                //保存非标日志信息
                syslogNonNormalMessage.setReason("未命中规则");
                syslogNonNormalMessage.setReasonDetail("失败详情：logColumnMap对象字段为空"   );
                if(isSaveNonNormal==false)
                SaveNonNormalMessage(deviceId,DateTime.now());
                return ;
            }
            Map<String, Object> columnMap = logColumnMap;
            //补全设备信息字段
            CompletionDeviceInfo(columnMap, deviceId);

            columnMap.put("device_id", deviceId);
            columnMap.put("log_time", logtime);
            columnMap.put("id", UUID.randomUUID().toString());
            columnMap.put("normalize_rule_id", normalizeRuleId);
            columnMap.put("normalize_rule_name", normalizeRuleName);
            columnMap.put("syslog_uuid", this.strSyslogUUID);
            columnMap.put("syslog_topic", this.strSyslogTopic);
            System.out.println("columnMap："+columnMap);
            syslogNormalDataService.insertDynamic(columnMap);
        } catch (Exception e) {
            logger.error("SaveNormalData失败 " );
            //保存非标日志信息
            syslogNonNormalMessage.setReason("入库失败");
            syslogNonNormalMessage.setReasonDetail("入库失败,normalizeRuleName :"+normalizeRuleName+",失败详情："+ e.getMessage());
            if(isSaveNonNormal==false)
            SaveNonNormalMessage(deviceId,DateTime.now());
            throw new RuntimeException("SaveNormalData 失败: " + e.getMessage(), e);
        }
    }

    /**
     * 补全设备信息字段
     * @param columnMap
     * @param deviceID
     */
    public  void CompletionDeviceInfo(Map<String, Object> columnMap ,Long deviceID)
    {
        try {
            DeviceDevice devInfo = deviceDeviceService.getByIdSafely(  Long.valueOf(deviceID).intValue() );
            if (devInfo != null) {
                columnMap.put("device_ip", devInfo.getIp());
                columnMap.put("device_manufacturer", devInfo.getVendor());
                columnMap.put("device_name", devInfo.getName());
            }
        } catch (Exception e) {
            logger.error("CompletionDeviceInfo 失败！ID："+deviceID );
        }
    }

    /**
     * 保存非标日志记录
     * @param deviceId
     * @param logtime
     */
    public void SaveNonNormalMessage(long deviceId , DateTime logtime)
    {
        try {
            SyslogNonNormalMessage normalMessage =new  SyslogNonNormalMessage() ;
            //获取日志对应的设备ID
            Integer collect_id= Integer.parseInt(this.deviceInfoMap.get("device_collect_id"));
            DeviceCollectTask deviceCollectTask=deviceCollectTaskService.getById(collect_id);
            normalMessage.setId( UUID.randomUUID().toString());
            normalMessage.setDeviceId((int)deviceId);
            normalMessage.setLogTime(logtime.toLocalDateTime());
            normalMessage.setRuleTime(logtime.toLocalDateTime());
            normalMessage.setSyslogMessage(this.strLogMsg);
            normalMessage.setSyslogTopic(this.strSyslogTopic);
            normalMessage.setSyslogUuid(this.strSyslogUUID);
            normalMessage.setHeaderMessage(this.strDeviceInfo);
            normalMessage.setEtlNode("etlgo");
            normalMessage.setReason( syslogNonNormalMessage.getReason());
            normalMessage.setReasonDetail( syslogNonNormalMessage.getReasonDetail());
            //采集探针名称
            normalMessage.setRuleResult("FAIL");
            normalMessage.setDeviceName(deviceInfoMap.get("device_name"));
            normalMessage.setCollectTaskId(collect_id);
            if(deviceCollectTask!=null)
            normalMessage.setCollectTaskName(deviceCollectTask.getTaskName());
            this.messageService.saveMessage(normalMessage );
            isSaveNonNormal=true;

        } catch (Exception e) {
            logger.error("SaveNonNormalMessage  失败：" );
            throw new RuntimeException("SaveNonNormalMessage 失败: " + e.getMessage(), e);
        }
    }


    public static void main(String[] args) {

        String strlogMessage= "<14>1 2025-09-24T11:52:26Z 5f46d3be75e1 supermario 128 honeypot_event - ﻿{\"source\":\"honeypot1\",\"id\":\"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a\",\"start_time\":\"2023-09-03T11:07:02.50167643Z\",\"time\":\"2023-09-03T11:16:18.883885281Z\",\"risk_level\":4,\"connection\":\"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf\",\"file_info\":null,\"extra\":{\"payload\":{\"format\":\"line\",\"name\":{\"cn\":\"攻击载荷\",\"en\":\"payload\"},\"value\":\"\"},\"uid\":{\"format\":\"line\",\"name\":{\"cn\":\"\",\"en\":\"\"},\"uid\":\"b4cbc73c-25d0-4429-ae1b-a856cdf1a651\",\"value\":\"\"}},\"type\":\"WEB_ATTACK_SCANNER\",\"agent_sn\":\"caa7da42-0cca-4cb1-b501-1f1eb2b588d5\",\"agent_name\":\" 教育局蜜罐探针\",\"honeypot_id\":\"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6\",\"honeypot_name\":\"茂名市中小学管理平台管理后台\",\"src_ip\":\"117.50.189.7\",\"src_port\":58512,\"src_mac\":\"\",\"dest_ip\":\"192.168.222.2\",\"dest_port\":9200,\"proxy_ip\":null,\"node\":\"WRx3\"}";
        String strMsgContent= "﻿{\"source\":\"honeypot1\",\"id\":\"f6a13c35-bf9d-4da6-a181-50ce23e7ef6a\",\"start_time\":\"2023-09-03T11:07:02.50167643Z\",\"time\":\"2023-09-03T11:16:18.883885281Z\",\"risk_level\":4,\"connection\":\"b18f3fbe-3fbf-4495-815f-ff26f6fb0bdf\",\"file_info\":null,\"extra\":{\"payload\":{\"format\":\"line\",\"name\":{\"cn\":\"攻击载荷\",\"en\":\"payload\"},\"value\":\"\"},\"uid\":{\"format\":\"line\",\"name\":{\"cn\":\"\",\"en\":\"\"},\"uid\":\"b4cbc73c-25d0-4429-ae1b-a856cdf1a651\",\"value\":\"\"}},\"type\":\"WEB_ATTACK_SCANNER\",\"agent_sn\":\"caa7da42-0cca-4cb1-b501-1f1eb2b588d5\",\"agent_name\":\" 教育局蜜罐探针\",\"honeypot_id\":\"11a9ac6bdf38ae2aaa49ec4f1b4a921bff71952cb9f175bdd8ee1f0497057bc6\",\"honeypot_name\":\"茂名市中小学管理平台管理后台\",\"src_ip\":\"117.50.189.7\",\"src_port\":58512,\"src_mac\":\"\",\"dest_ip\":\"192.168.222.2\",\"dest_port\":9200,\"proxy_ip\":null,\"node\":\"WRx3\"}";
        //Map<String, Object> flatMap  =(new logNormalData()).getMessageToMap(strMsgContent);
        //flatMap.forEach((key, value) -> System.out.println(key + " = " + value));
        //LogNormalProcessor  logData =new LogNormalProcessor(strlogMessage,);
        //logData.init();
    }
}



